fix: slug extra user names into k8s secret names

[dannash100]

Consumers don't derive this name: the Secret is labelled pgro.bes.au/component=extra-user-creds + pgro.bes.au/replica=<name>, and carries the unslugged role under username.

An underscore in a role name (tupaia_read) made an invalid Secret name, and ensure_extra_user_secrets failing with ? stopped the replica reconcile before it scheduled a restore.

• slug the username, so tupaia_read lands on <replica>-user-tupaia-read-creds
• two roles that slug alike would share a Secret; declaring both is a config error we accept
• no migration, the Secret was never created on any affected replica

Regression from #129 (v0.4.18).

[dannash100]

🤖 Renaming the declared user to tupaia-read in Canopy unblocks the three stale replicas within the hour, no release or image bump needed. Tupaia's connection config would have to change at the same time.

This PR is the other half: without it, a role name that can't be a k8s name takes that replica's restores down silently until someone reads the operator log.